English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Adversarial examples are well-designed input samples, in which perturbationsare imperceptible to the human eyes, but easily mislead the output of deepneural networks (DNNs). Existing works synthesize adversarial examples byleveraging simple metrics to penalize perturbations, that lack sufficientconsideration of the human visual system (HVS), which produces noticeableartifacts. To explore why the perturbations are visible, this paper summarizesfour primary factors affecting the perceptibility of human eyes. Based on thisinvestigation, we design a multi-factor metric MulFactorLoss for measuring theperceptual loss between benign examples and adversarial ones. In order to testthe imperceptibility of the multi-factor metric, we propose a novel black-boxadversarial attack that is referred to as GreedyFool. GreedyFool appliesdifferential evolution to evaluate the effects of perturbed pixels on theconfidence of a target DNN, and introduces greedy approximation toautomatically generate adversarial perturbations. We conduct extensiveexperiments on the ImageNet and CIFRA-10 datasets and a comprehensive userstudy with 60 participants. The experimental results demonstrate thatMulFactorLoss is a more imperceptible metric than the existing pixelwisemetrics, and GreedyFool achieves a 100% success rate in a black-box manner.

GreedyFool: Multi-Factor Imperceptibility and Its Application to Designing a Black-box Adversarial Attack